KR101770417B1 - Validating the identity of a mobile application for mobile application management - Google Patents

Abstract

A method of managing access to corporate resources is provided. The access manager may operate on the mobile device to verify the mobile application installed on the mobile device. If the access manager does not successfully validate the mobile application, the access manager can prevent the mobile application from accessing the computing resource. If the access manager successfully validates the mobile application, the access manager can identify the mobile application as a trusted mobile application. The access manager may allow a trusted mobile application to access the computing resource.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention < RTI ID = 0.0 > [0001] < / RTI &

[0001] This application claims priority to U.S. Serial No. 13 / 898,167, filed May 20, 2013, entitled " VALIDATING THE IDENTITY OF A MOBILE APPLICATION FOR MOBILE APPLICATION MANAGEMENT, No. 61 / 806,577, filed on March 29, 2013, entitled " Methods for Enterprise Mobility Management ".

[0002] The aspects described herein generally relate to the management of mobile applications of mobile computing devices. In particular, various aspects provide approaches for verifying a mobile application running on an unmanaged device and controlling the execution of the mobile application.

[0003] The use of mobile computing devices continues to grow. In particular, companies and other companies have relied on mobile computing devices to allow individuals to remotely access various computing resources. Such resources may include, for example, e-mail services, file services, data, and other electronic resources provided by corporate computer systems or by the mobile device itself.

[0004] Whether an individual is locally or remotely located with respect to computing resources, an enterprise is trying to protect and control access to its computing resources. Thus, an enterprise may use a variety of technical mechanisms (e.g., gateways and firewalls) as well as access control mechanisms (e.g., user authentication And authorization). These mechanisms may also prevent unauthorized individuals from accessing any of the computing resources.

[0005] For mobile devices, an enterprise can use a variety of approaches to control remote access to computing resources from the mobile devices. This effort can be referred to as mobile device management. In one approach, an enterprise can provide enterprise-owned and enterprise-controlled mobile devices to individuals. Such a device may be configured so that the enterprise controls the configuration, functionality, operation and data of the mobile device. In this regard, the enterprise-controlled mobile device may be referred to as a managed device. The enterprise can remotely control the managed device via a client-server architecture, for example. The enterprise server may remotely issue commands to a client application residing on the management device. These commands may include, for example, installing new applications or functions, updating existing applications or functions, updating configuration settings, providing data, and the like. If a managed device is lost or stolen, the enterprise issues commands to lock or wipe the device to prevent unauthorized individuals from accessing or accessing the devices through the device can do.

[0006] However, individuals may feel inconvenience in maintaining both corporate-owned mobile devices as well as personal mobile devices. Instead, individuals may prefer to access resources by their personal mobile devices. Its implementation may be referred to as BYOD (bring-your-own-device). Since these individual devices may not be controlled by the enterprise, these individual devices may be referred to as unmanaged devices. To meet this preference, solutions are being developed that allow unmanaged devices to access these resources.

[0007] For example, a managed mobile application that is configured to operate on an unmanaged device, either providing a corporate-controlled mobile application, is one approach that is currently under development. However, the difficulties still remain. To allow managed mobile applications running on unmanaged devices to be a viable approach, mechanisms may be needed to prevent unauthorized access to, or unauthorized use of, resources unauthorized through a managed mobile application. In particular, there is a need to verify the identity of the management mobile application in order to allow the management mobile application to change in order to avoid security mechanisms protecting the resources. Moreover, there is a need to control the operation of the management mobile application of the unmanaged mobile device.

[0008] The following description presents a simplified summary of the various aspects set forth herein. This summary is not a comprehensive overview, nor is it intended to identify key or critical elements or to delineate the scope of the claims. The following summary merely presents some concepts in a simplified form as an introduction to the detailed description provided below.

[0009] In order to overcome the limitations of the prior art described above and to overcome other limitations which will become apparent upon reading and understanding the present specification, aspects described herein may be implemented using mobile computing devices of the mobile computing devices, To controlling access to computing resources. Moreover, aspects of the present disclosure relate to controlling access to local computing resources of mobile computing devices themselves. The access manager may perform a validation process that determines whether the mobile application that is requesting access to the computing resources has correctly identified itself and has not changed since it was installed on the mobile computing device. In this manner, the access manager can ensure that the mobile application requesting access to the computing resource does not attempt to circumvent the security mechanisms that may be trusted and used to protect those resources. As a result, individuals associated with the enterprise can leverage remote and local computing resources with their personal mobile devices.

[0010] The first aspect described herein provides a method for managing access to enterprise resources. The access manager may operate on the mobile device to verify the mobile application installed on the mobile device. If the access manager does not successfully validate the mobile application, the access manager can prevent the mobile application from accessing the computing resource. If the access manager successfully validates the mobile application, the access manager can identify the mobile application as a trusted mobile application. Thus, the access manager may allow trusted mobile applications to access the computing resources.

[0011] A second aspect described herein provides a mobile computing device. The mobile computing device may include a mobile application configured to access computing resources, stored identification information associated with the mobile application, and an access manager. The access manager may be configured to verify the mobile application and block or allow access to the computing resources, as described above.

[0012] A third aspect described herein provides an access manager configured to operate in a mobile device. As described above, the access manager may also be configured to verify the mobile application of the mobile device and block or allow access to the computing resource via the mobile application. The access manager may be further configured to control the operation of the mobile application based on an application policy stored in the mobile application.

[0013] Some aspects described herein provide that stored identification information may be associated with a mobile application and may be the original digital certificate generated with it. The access manager can verify the mobile application by comparing the digital certificate received from the mobile operating system of the mobile computing device with the original digital certificate generated for the mobile application. The computing resources may be located locally or remotely to the mobile computing device. Examples of computing resources include, but are not limited to, software applications running on a mobile computing device or a remote computing system, services provided by a mobile computing device or a remote computing system, data stored on a mobile computing device or remote computing system, hardware of a mobile computing device or remote computing system Or a combination thereof.

[0014] The stored identification information may also be embedded in the mobile application at the time of creation or identification tokens derived from the mobile application. The application signature may be constructed based on an arrangement of embedded and derived identification tokens. The access manager may also provide nonce during verification for the mobile application, and may use nonce to compute the expected hash value, using application signatures and nonsense. The access manager may generate an expected response, e.g., the expected hash value, to compare the expected response with the response received from the mobile application after a challenge from the access manager.

[0015] These and further aspects will be recognized in conjunction with the advantages of the disclosure discussed in more detail below.

BRIEF DESCRIPTION OF THE DRAWINGS [0016] The aspects described herein and their advantages may be more fully understood by reference to the following detailed description, taken in conjunction with the accompanying drawings, wherein like reference numerals denote like features.
[0017] FIG. 1 illustrates an exemplary computer system architecture that may be used in accordance with one or more exemplary aspects set forth herein.
[0018] FIG. 2 illustrates an exemplary remote-access system architecture that may be used in accordance with one or more exemplary aspects set forth herein.
[0019] FIG. 3 illustrates an exemplary virtualization (hypervisor) system architecture that may be used in accordance with one or more exemplary aspects set forth herein.
[0020] FIG. 4 illustrates an exemplary cloud-based system architecture that may be used in accordance with one or more illustrative aspects described herein.
[0021] FIG. 5 illustrates an exemplary enterprise mobility management system.
[0022] FIG. 6 illustrates another exemplary enterprise mobility management system.
[0023] FIG. 7 illustrates an exemplary mobile device management system.
[0024] FIG. 8 shows a block diagram of an exemplary application signature and challenge response for a management mobile application.
[0025] FIG. 9 is a flow diagram of exemplary method steps for managing a mobile application of an unmanaged mobile device.
[0026] FIG. 10 is a flow diagram of exemplary method steps for preparing a management mobile application for management operations in an unmanaged mobile device.
[0027] Figure 11 is a flow diagram of exemplary method steps for initializing a managed mobile application in an unmanaged mobile device.
[0028] Figure 12 is a flow diagram of exemplary method steps for verifying a managed mobile application in an unmanaged mobile device with a mobile operating system of a first type.
[0029] FIG. 13 is a flow diagram of exemplary method steps for verifying a managed mobile application in an unmanaged mobile device having a second type of mobile operating system.
[0030] FIG. 14 is a flow diagram of exemplary method steps for enforcing application policies during operation of a management mobile application.

BRIEF DESCRIPTION OF THE DRAWINGS [0031] The following description of the various embodiments forms part of the embodiments and references to the above identified embodiments, in which are shown various exemplary embodiments in which aspects described herein may be practiced. It is to be understood that other embodiments may be utilized and that the structure and function may be modified without departing from the scope of the invention as described herein. The various aspects enable other embodiments and may be practiced or carried out in various different ways.

As a general overview of the subject matter described in detail below, aspects described herein relate to controlling remote and local access to computing resources in remotely located enterprise computing systems or in mobile computing devices themselves will be. The access manager may perform a validation process that determines whether the mobile application requesting access to the computing resources has correctly identified itself and has not changed since its installation on the mobile computing device. In this manner, the access manager can ensure that the mobile application requesting access to the computing resource does not attempt to circumvent the security mechanisms that may be trusted and used to protect those resources. As a result, individuals associated with the enterprise can leverage the computing resources with their personal mobile devices. The computing resources may be located locally or remotely to the mobile computing device. Examples of computing resources include, but are not limited to, software applications running on a mobile computing device or a remote computing system, services provided by a mobile computing device or a remote computing system, data stored on a mobile computing device or a remote computing system, Hardware, and combinations thereof. In this disclosure, computing resources remotely located in a company ' s computing system are referred to as enterprise resources.

[0033] It is to be understood that the phraseology and terminology employed herein is for the purpose of description and should not be regarded as limiting. Rather, the phrases and terminology used herein should be accorded the broadest interpretation and meaning of their abbreviations. The use of "comprising" and "comprising" and variations thereof is meant to include the items listed thereafter and equivalents thereof as well as additional items and equivalents thereof. The use of the terms "attached," " coupled, "" coupled," " positioned ", "coupled ", and similar terms refer to direct and indirect mounting, And < RTI ID = 0.0 > and / or < / RTI >

[0034] Computing Architecture

[0035] Computer software, hardware and networks can be utilized in a variety of different system environments, especially including standalone, networked, remote-access (also known as remote desktops), virtualization and / or cloud- have. 1 illustrates an example of a system architecture and data processing device that may be used to implement one or more exemplary aspects of the present disclosure in a standalone and / or networked environment. The various network nodes 103, 105, 107, and 109 may be interconnected via a wide area network (WAN) 101, e.g., the Internet. Other networks may also or alternatively be used, including private intranets, corporate networks, LANs, metropolitan area networks (MANs), wireless networks, personal networks (PANs) The network 101 is for illustrative purposes and can be replaced with fewer computer networks or with a greater number of computer networks. A local area network (LAN) may have one or more of any known LAN topologies, and may use one or more of a variety of different protocols, such as Ethernet. The devices 103,105, 107,109 and other devices (not shown) may be connected to one or more of the networks via twisted pair wires, coaxial cables, optical fibers, radio waves or other communication media.

[0036] The term "network " as used herein and illustrated in the figures may be coupled to systems in which remote storage devices are coupled together via one or more communication paths, as well as occasionally storage systems Lt; / RTI > devices. Consequently, the term "network" includes not only a "physical network ", but also a" content network ", wherein the "content network" consists of data residing across all of the physical networks.

[0037] The components may include a data server 103, a web server 105, and client computers 107, 109. The data server 103 provides full access, control, and management of control software and databases for performing one or more exemplary aspects of the disclosure described herein. The data server 103 may be connected to the web server 105 and through the web server 105 users interact with the requested data to obtain this data. Alternatively, the data server 103 may act as a web server by itself and may be directly connected to the Internet. The data server 103 may be connected to the web server 105 via the network 101 (e.g., the Internet), directly or indirectly, or some other network. Users can connect to the data server 103 via one or more externally exposed web sites hosted by the web server 105 and use the remote computers 107 and 109 to retrieve data Server 103. < / RTI > Client computers 107 and 109 may be used in conjunction with data server 103 to access data stored in data server 103 or may be used for other purposes. For example, from the client device 107, a user may use a software application that communicates with the web server 105 and / or the data server 103 using an Internet browser known in the art or via a computer network (e.g., the Internet) And can access the Web server 105 by executing it.

[0038] Servers and applications can be combined on the same physical machines, can have separate virtual or logical addresses, or can reside on separate physical machines. Figure 1 illustrates only one example of a network architecture that may be used and one of ordinary skill in the art will recognize that the particular network architecture and data processing devices used may be altered, as will be further described herein, . For example, the services provided by the web server 105 and the data server 103 may be combined on a single server.

[0039] Each component 103, 105, 107, 109 may be any type of well-known computer, server, or data processing device. The data server 103 may comprise a processor 111 for controlling the overall operation of a rate server 103, for example. The data server 103 further includes a RAM 113, a ROM 115, a network interface 117, input / output interfaces 119 (e.g., keyboard, mouse, can do. I / O 119 may include various interface units and drives for reading, writing, displaying, and / or printing data or files. The memory 121 includes operating system software 123 for controlling the overall operation of the data processing device 103, control logic 125 for instructing the data server 103 to perform aspects of the disclosure described herein, , And other application software 127 that provides secondary functions, support functions, and / or other functions that may be used with aspects of the present disclosure or may not be used with aspects described herein Can be stored. The control logic may also be referred to herein as data server software 125. The functionality of the data server software may be automatically generated based on rules coded in the control logic or may be manually generated by the user providing input in the system or may be automatically generated based on user input (e.g., queries, data updates, etc.) May refer to actions or decisions made in combination with processing.

[0040] The memory 121, including the first database 129 and the second database 131, may also store data used in performing one or more aspects of the present disclosure. In some embodiments, the first database may comprise a second database (e.g., as an individual table, report, etc.). That is, depending on the system design, the information may be stored in a single database or may be separated into different logical, virtual or physical databases. The devices 105, 107, and 109 may have similar or different architectures as those described in connection with the device 103. Those skilled in the art will appreciate that the functionality of the data processing device 103 (or devices 105, 107, 109) described herein may be used, for example, to distribute the processing load across multiple computers, May be distributed across multiple data processing devices to separate transactions based on quality of service (QoS) and the like.

[0041] One or more aspects may be implemented as computer-usable or readable data and / or computer-executable instructions, as described herein, such as one or more program modules . ≪ / RTI > Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types when executed by a computer or other device's processor do. The modules may be written in a source code programming language compiled later for execution or written in a scripting language such as but not limited to HTML or XML. Computer-executable instructions may be stored on a computer-readable medium, such as a non-volatile storage device. Any suitable computer readable storage medium can be utilized including hard disks, CD-ROMs, optical storage devices, magnetic storage devices, and / or any combination thereof. Moreover, the various transmission (non-storing) media representing the data or events as described herein may be implemented as a signal such as metal wires, optical fibers, and / or wireless transmission media (e.g., air and / Can be moved between the source and destination in the form of electromagnetic waves traveling through the signal-conducting media. The various aspects described herein may be implemented as a method, a data processing system, or a computer program product. Thus, the various functions may be implemented in whole or in part by software, firmware and / or hardware or hardware equivalents such as integrated circuits, field programmable gate arrays (FPGAs), and the like. Certain data structures may be used to more effectively implement one or more aspects of the disclosure, and such data structures are contemplated to be within the scope of computer-usable instructions and computer-usable data described herein.

[0042] Referring additionally to FIG. 2, one or more aspects described herein may be implemented in a remote-access environment. FIG. 2 illustrates an exemplary system architecture including a general purpose computing device 201 of an exemplary computing environment 200 that may be used in accordance with one or more illustrative aspects described herein. The general purpose computing device 201 may be used as a server 206a in a single-server or multi-server desktop virtualization system (e.g., a remote access or cloud system) configured to provide virtual machines to client access devices. The general purpose computing device 201 includes a server 205 and a server 208 including a random access memory (RAM) 205, a read-only memory (ROM) 207, an input / output (I / O) module 209, And a processor 203 for controlling the overall operation of the associated components.

The user of the general purpose computing device 201 may receive input from the input / output module 209 via a mouse, a keypad, a touch screen, a scanner, an optical reader, and / or a stylus (or other input device (s) And may also include one or more of a speaker for providing audio output and a video display device for providing text, audiovisual and / or graphical output. The software may be stored in the memory 215 and / or other storage to provide the processor 203 with instructions for configuring the general purpose computing device 201 as a special purpose computing device to perform various functions as described herein . For example, memory 215 may store software used by computing device 201, e.g., operating system 217, application programs 219, and associated database 221.

[0044] The computing device 201 may operate in a networked environment that supports connections to one or more remote computers, such as terminals 240 (also referred to as client devices). Terminals 240 may be personal computers, mobile devices, laptop computers, tablets or servers, including all or a combination of the elements described above in connection with the general purpose computing device 103 or 201. The network connections shown in FIG. 2 include a local area network (LAN) 225 and a wide area network (WAN) 229, but may also include other networks. When used in a LAN networking environment, the computing device 201 may be connected to the LAN 225 via a network interface or adapter 223. When used in a WAN networking environment, the computing device 201 may include a modem 227 or other wide area network interface for establishing communications over the WAN 229, such as a computer network 230 (e.g., the Internet) have. It will be appreciated that the network connections shown are exemplary and other means of establishing a communication link between the computers may be used. Computing device 201 and / or terminals 240 may also include mobile terminals (e.g., mobile phones, smart phones, PDAs, etc.) including batteries, speakers, and various other components such as antennas Notebooks, etc.).

[0045] The aspects described herein may also be operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of other computing systems, environments, and / or configurations that may be suitable for use with the aspects described herein include, but are not limited to, personal computers, server computers, hand-held or laptop devices, Microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the preceding systems or devices, But are not limited to these.

[0046] As shown in FIG. 2, one or more client devices 240 may communicate with one or more servers 206a-206n (generally referred to herein as "server (s) 206") . In one embodiment, computing environment 200 may include a network appliance installed between server (s) 206 and client machine (s) The network appliances may manage client / server connections and in some cases may load balance client connections between the plurality of backend servers 206.

In some embodiments, client (s) 240 may be referred to as a single client machine 240 or a single group of client machines 240, while server (s) May be referred to as a single group of servers 206 or servers 206. In one embodiment, a single client machine 240 communicates with two or more servers 206, while in another embodiment, a single server 206 communicates with two or more client machines 240. In yet another embodiment, a single client machine 240 communicates with a single server 206.

[0048] In some embodiments, client machine 240 includes the following non-generic terms: client machine (s); Client (s); Client computer (s); Client device (s); Client computing device (s); Local machine; Remote machine; Client node (s); May be referred to as either endpoint (s) or endpoint node (s). In some embodiments, the server 206 includes the following non-generic terms: server (s); Local machine; Remote machine; Server farm (s) or host computing device (s).

[0049] In one embodiment, client machine 240 may be a virtual machine. While in some embodiments the virtual machine may be a type 1 or type 2 hypervisor, such as a hypervisor developed by Citrix Systems, IBM, VMware, or any other And may be any virtual machine managed by the hypervisor. In some aspects, the virtual machine may be managed by the hypervisor, while in aspects the virtual machine may be managed by the hypervisor running on the server 206 or by the hypervisor running on the client 240 .

[0050] Some embodiments include a client device 240 that displays an application output that is generated by an application that is run remotely on the server 206 or another remotely located machine. In these embodiments, client device 240 may execute a virtual machine receiver program or application to display the output of an application window, browser, or other output window. In one example, the application is a desktop, while in other instances the application is an application that creates or presents a desktop. The desktop may include a graphical shell that provides a user interface to an instance of the operating system in which local and / or remote applications may be integrated. Applications such as those described herein are programs that run after an instance of an operating system (and optionally also a desktop) is loaded.

 [0051] In some embodiments, the server 206 may be coupled to a thin-client or remote-display application running on the client to present a display output generated by an application executing on the server 206 Use a remote presentation protocol or other program to transmit the data. The thin-client or remote-display protocol is described in the following non-exhaustive list of protocols: Independent Computing Architecture (ICA) protocol developed by Citrix Systems, Inc., located in Fort Lauderdale, Florida or Microsoft Corporation, Or RDP (Remote Desktop Protocol) manufactured by the same manufacturer.

[0052] The remote computing environment may include two or more servers 206a-206n, for example, so that in a cloud computing environment, servers 206a-206n are logically grouped together into a server farm 206. The server farm 206 may include servers 206 that are geographically dispersed while logically grouped together, or servers 206 that are logically grouped together while being placed close together. In some embodiments, the geographically dispersed servers 206a-206n within the server farm 206 may communicate using WAN (wide area), MAN (metropolitan), or LAN (area), where different geographic areas Different continents; Different continental regions; Different countries; Different states; Different cities; Different campuses; Different rooms; Or any combination of the above geographic locations. In some embodiments, the server farm 206 may be managed as a single entity, while in other embodiments, the server farm 206 may comprise multiple server farms.

[0053] In some embodiments, the server farm may include servers 206 executing substantially similar types of operating system platforms (eg, WINDOWS, UNIX, LINUX, iOS, ANDROID, SYMBIAN, etc.). In other embodiments, the server farm 206 includes a first group of one or more servers running a first type of operating system platform and a second group of one or more servers running a second type of operating system platform .

The server 206 may be any type of server as required, such as a file server, an application server, a web server, a proxy server, an appliance, a network appliance, a gateway, an application gateway, a gateway server, As an SSL VPN server, as a firewall, as a web server, as an application server, or as a server running a master application server, a server running Active Directory, or an application acceleration program providing firewall function, application function or load balancing function . Other server types may also be used.

[0055] Some embodiments receive requests from the client machine 240, forward requests to the second server 106b, and generate requests from the client machine 240 in response from the second server 106b And a first server 106a that responds to the request. The first server 106a may obtain address information associated with the application server 206 hosting the application identified in the list of applications as well as a list of applications available to the client machine 240. [ The first server 106a may then use the web interface to present a response to the request of the client and may communicate directly with the client 240 to provide access to the identified application have. One or more clients 240 and / or one or more servers 206 may transmit data over the network 230, e.g.,

[0056] Figure 2 illustrates a high-level architecture of an exemplary desktop virtualization system. As shown, the desktop virtualization system may include a single-server or multi-server 200, including at least one virtualization server 206 configured to provide virtual desktops and / or virtual applications to one or more client access devices 240. [ System or a cloud system. As used herein, a desktop refers to a graphical environment or space in which one or more applications are hosted and / or executed. The desktop may include a graphics shell that provides a user interface to an instance of the operating system in which local and / or remote applications may be integrated. Applications may include programs that run after an instance of an operating system (and optionally also a desktop) is loaded. Each instance of the operating system may be physical (e.g., one operating system per device) or virtual (e.g., many instances of an OS running on a single device). Each application may be executed on a local device or may be executed on a remotely located device (e.g., a remote device).

[0057] Referring additionally to FIG. 3, computer device 301 may be configured as a virtualization server in a virtualized environment, such as a single-server, multi-server, or cloud computing environment. The virtualization server 301 illustrated in FIG. 3 may be deployed and / or implemented by one or more embodiments of the server 206 illustrated in FIG. 2 or other known computing devices. Included in the virtualization server 301 is hardware that may include one or more physical disks 304, one or more physical devices 306, one or more physical processors 308, and one or more physical memories 316 Layer. In some embodiments, the firmware 312 may be stored in a memory element of the physical memory 316 and may be executed by one or more of the physical processors 308. The virtualization server 301 may further include an operating system 314 that may be stored in a memory element of the physical memory 316 and executed by one or more of the physical processors 308. [ The hypervisor 302 may also be stored in a memory element of the physical memory 316 and may be executed by one or more of the physical processors 308. [

[0058] It may be one or more virtual machines 332A-C (generally 332) to execute on one or more of the physical processors 308. Each virtual machine 332 may have virtual disks 326A-C and virtual processors 328A-C. In some embodiments, the first virtual machine 332A may execute a control program 320 that includes a tools stack 324 using the virtual processor 328A. The control program 320 may be referred to as a control virtual machine, Dom0, Domain 0, or other virtual machine used for system operation and / or control. In some embodiments, one or more virtual machines 332B-C may execute guest operating systems 330A-B using virtual processors 328B-C.

[0059] The virtualization server 301 may include a hardware layer 310 having one or more pieces of hardware in communication with the virtualization server 301. In some embodiments, the hardware layer 310 may include one or more physical disks 304, one or more physical devices 306, one or more physical processors 308, and one or more memory 316 . The physical components 304, 306, 308, and 316 may include, for example, any of the components described above. The physical devices 306 may be, for example, a network interface card, a video card, a keyboard, a mouse, an input device, a monitor, a display device, speakers, an optical drive, a storage device, a universal serial bus connection, , A router, a firewall, a network address translator, a load balancer, a virtual private network (VPN) gateway, a Dynamic Host Configuration Protocol (DHCP) router, etc.), or any device connected to or in communication with the virtualization server 301 have. The physical memory 316 of the hardware layer 310 may comprise any type of memory. The physical memory 316 may store data and, in some embodiments, may store one or more programs, or a set of executable instructions. Figure 3 illustrates an embodiment in which firmware 312 is stored in physical memory 316 of virtualization server 301. [ Programs or executable instructions stored in physical memory 316 may be executed by one or more processors 308 of virtualization server 301. [

[0060] The virtualization server 301 may also include a hypervisor 302. In some embodiments, the hypervisor 302 may be a program that is executed by the processors 308 on the virtualization server 301 to create and manage any number of virtual machines 332. The hypervisor 302 may be referred to as a virtual machine monitor or platform virtualization software. In some embodiments, the hypervisor 302 may be any combination of hardware and executable instructions for monitoring virtual machines running on a computing machine. The hypervisor 302 may be a type 2 hypervisor, wherein a hypervisor running within the operating system 314 may be executed on the virtualization server 301. [ The virtual machines are then executed at a higher level than the hypervisor. In some embodiments, the Type 2 hypervisor is executed within the context of the user's operating system, and the Type 2 hypervisor interacts with the user's operating system. In other embodiments, one or more virtualization servers 301 in a virtualized environment may instead include a type 1 hypervisor (not shown). The type 1 hypervisor may be run on the virtualization server 301 by accessing hardware and hardware in the hardware layer 310 directly. That is, although the Type 2 hypervisor 302 accesses system resources through the host operating system 314 as shown, the Type 1 hypervisor can directly access all system resources without the host operating system 314 . The type 1 hypervisor may execute directly on one or more physical processors 308 of virtualization server 301 and may include program data stored in physical memory 316. [

[0061] In some embodiments, the hypervisor 302 is operatively coupled to an operating system 330 that runs on virtual machines 332 in any manner that simulates direct access to system resources by operating system 330 or control program 320 And may provide virtual resources to the frameworks 330 or control programs 320. System resources include physical devices 306, physical disks 304, physical processors 308, physical memory 316 and any other components included in the virtualization server 301 hardware layer 310 But is not limited thereto. The hypervisor 302 may be used to execute virtual machines that emulate virtual hardware, partition physical hardware, virtualize physical hardware, and / or provide access to computing environments. In yet another embodiment, the hypervisor 302 controls memory partitioning and processor scheduling for the virtual machine 332 running on the virtualization server 301. The hypervisor 302 is manufactured by VMWare, Inc., located in Palo Alto, California; The XEN hypervisor, an open source product whose development is overseen by the open source Xen.org community; VHyperV provided by Microsoft, VirtualServer or virtual PC hypervisors or other hypervisor. In some embodiments, the virtualization server 301 executes a hypervisor 302 that creates a virtual machine platform on which guest operating systems can run. In these embodiments, the virtualization server 301 may be referred to as a host server. An example of such a virtualization server is XEN SERVER, which is provided by Citrix Systems, Inc., located in Fort Lauderdale, Florida.

[0062] The hypervisor 302 may create one or more virtual machines 332B-C (generally 332) in which the guest operating system 330 is running. In some embodiments, the hypervisor 302 may load the virtual machine image to create the virtual machine 332. In other embodiments, the hypervisor 302 may execute the guest operating system 330 within the virtual machine 332. In another embodiment, the virtual machine 332 may execute the guest operating system 330. [

[0063] In addition to creating virtual machines 332, the hypervisor 302 can control the execution of at least one virtual machine 332. In other embodiments, the hypervisor 302 may be implemented as an abstraction of at least one hardware resource provided by the virtualization server 301 (e.g., any hardware resource available in the hardware layer 310) (332). In other embodiments, the hypervisor 302 may control the manner in which the virtual machines 332 access the physical processors 308 available in the virtualization server 301. Controlling access to physical processors 308 includes determining whether virtual machine 332 should have access to processor 308 and how physical processor functions are provided to virtual machine 332 can do.

[0064] As shown in FIG. 3, the virtualization server 301 may host or execute one or more virtual machines 332. The virtual machine 332 is a set of executable instructions that when executed by the processor 308 allows the virtual machine 332 to execute programs and processes in much the same manner as a physical computing device, to be. 3 illustrates an embodiment in which the virtualization server 301 hosts three virtual machines 332, however, in other embodiments, the virtualization server 301 may include any number of virtual machines 332 You can host it. The hypervisor 302 may in some embodiments each virtual machine 332 include a unique virtual view of the physical hardware, memory, processor, and other system resources that the virtual machine 332 may utilize. ). In some embodiments, the unique virtual view may include virtual machine permissions, an application of a policy engine for one or more virtual machine identifiers, a user accessing a virtual machine, applications executing on a virtual machine, Networks accessed by the virtual machine, or any other desired criteria. For example, the hypervisor 302 may create one or more unsecured virtual machines 332 and one or more secure virtual machines 332. The non-secure virtual machines 332 may be blocked from accessing resources, hardware, memory locations and programs that the secure virtual machines 332 may be allowed to access. In other embodiments, the hypervisor 302 may provide each virtual machine 332 with a substantially similar view of the physical hardware, memory, processor, and other system resources available to the virtual machine 332 have.

[0065] Each virtual machine 332 may include virtual disks 326A-C (generally 326) and virtual processors 328A-C (generally 328). The virtual disk 326 may in some embodiments be a virtualized view of one or more physical disks 304 of the virtualization server 301 or a portion of one or more physical disks 304 of the virtualization server 301 virtualized view. The virtualized view of the physical disks 304 may be created, provisioned, and managed by the hypervisor 302. In some embodiments, the hypervisor 302 provides a unique view of the physical disks 304 to each virtual machine 332. Thus, in these embodiments, the specific virtual disk 326 included in each virtual machine 332 may be unique compared to the other virtual disks 326. [

[0066] The virtual processor 328 may be a virtualized view of one or more physical processors 308 of the virtualization server 301. In some embodiments, the virtualized view of the physical processors 308 may be created, provided and managed by the hypervisor 302. In some embodiments, the virtual processor 328 has substantially the same characteristics as the at least one physical processor 308. In other embodiments, the virtual processor 308 provides a modified view of the physical processor 308 so that at least some of the features of the virtual processor 328 are associated with the corresponding physical processor 308 It is different from the features.

[0067] Referring additionally to FIG. 4, some aspects described herein may be implemented in a cloud-based environment. 4 illustrates an example of a cloud computing environment (or cloud system) 4, the client computers 411-414 communicate with the cloud management server 410 to provide computing resources (e. G., Host servers 403, storage resources 404, Network resources 405).

[0068] The management server 410 may be implemented on one or more physical servers. In particular, the management server 410 may execute CLOUDSTACK or OPENSTACK from Citrix Systems, Inc., located in Fort Lauderdale, Florida, for example. The management server 410 may manage a variety of computing resources including cloud hardware and software resources, such as host computers 403, data storage devices 404, and networking devices 405. [ Cloud hardware and software resources may include private and / or public components. For example, the cloud may be configured as a private cloud for use by a private network and / or by one or more specific customers or client computers 411-414. In other embodiments, public clouds or hybrid public-private clouds may be used by other customers over open or hybrid networks.

[0069] The management server 410 may be configured to provide user interfaces that enable cloud operators and cloud customers to interact with the cloud system. For example, the management server 410 can provide a set of APIs and / or one or more cloud operator console applications (e.g., web-based standalone applications) to the cloud operators to manage cloud resources, configure the virtualization layer, Provide user interfaces to manage accounts and perform other cloud operations tasks. The management server 410 may also receive requests for creating, modifying, or removing virtual machines in the cloud, from cloud computing requests from an end user via the client computers 411-414, A set of APIs and / or one or more customer console applications. The cloud computers 411-414 may connect to the management server 410 via the Internet or other communications network and may request access to one or more of the computing resources managed by the management server 410. [ In response to client requests, the management server 410 may include a resource manager configured to select and supply physical resources of the hardware layer of the cloud system based on client requests. For example, the management server 410 and additional components of the cloud system may communicate with virtual machines and their operating environments (e.g., hypervisors, virtual machines, etc.) for customers at the client computers 411-414 over a network Storage resources, services provided by network elements, etc.) to provide computational resources, data storage services, network functions and computer platform and application support to the customer can do. Cloud systems may also be configured to provide various specific services, including security systems, development environments, user interfaces, and the like.

[0070] Specific clients 411-414 may be associated with different client computers that create virtual machines on behalf of different end users or different users associated with the same company or organization, for example. In other instances, the particular clients 411-414 may not be associated with, for example, users associated with different companies or organizations. In the case of unrelated clients, information about virtual machines or storage of one user may be hidden by other users.

[0071] Referring now to the physical hardware layer of the cloud computing environment, availability zones 401-402 (or zones) refer to a collocated set of physical computing resources can do. Zones may be geographically separated from other zones of the entire cloud of computing resources. For example, zone 401 may be a first cloud data center located in California, and zone 402 may be a second cloud data center located in Florida. The management server 410 may be located in one of the available zones, or in a remote location. Each zone may include an internal network that interfaces with devices outside the zone, such as the management server 410, through a gateway. The end users of the cloud (e.g., clients 411-414) may or may not be able to distinguish between zones. For example, end users may request the creation of a virtual machine with a certain amount of memory, processing power, and network capabilities. The management server 410 may respond to the user's request and provide resources for creating the virtual machine without the user needing to know whether or not the virtual machine has been created using the resources of the zone 401 or zone 402 Can be assigned. In other instances, the cloud system may allow end-users to request that virtual machines (or other cloud resources) be allocated on a particular zone or on specific resources 403-405 within the zone.

[0072] In this example, each zone 401-402 includes various physical hardware components (or computing resources) 403-405, such as physical hosting resources (or processing resources), physical network resources , Physical storage resources, switches, and an array of additional hardware resources that can be used to provide customers with cloud computing services. The physical hosting resources of the cloud zones 401-402 may include one or more computer servers 403, such as the virtualization servers 301 described above, which are configured to create and host virtual machine instances . The physical network resources of the cloud zone 401 or 402 may provide network services such as firewalls, network address translators, load balancers, virtual private network (VPN) gateways, Dynamic Host Configuration Protocol (DHCP) routers, (E.g., network service providers) that include hardware and / or software configured to provide services and / or services. The storage resources of the cloud zones 401-402 may include storage disks (e.g., solid state drives (SSDs), magnetic hard disks, etc.) and other storage devices.

[0073] The exemplary cloud computing environment shown in FIG. 4 also includes a virtualization layer (eg, as shown in FIGS. 1-3), a virtualization layer that creates and manages virtual machines and utilizes the physical resources of the cloud Or additional software and / or software resources configured to provide services. The virtualization layer may include hypervisors as described above in FIG. 3, and other components that provide network virtualizations, storage virtualizations, and the like. The virtualization layer may be a separate layer from the physical resource layer, or may share some or all of the same hardware and / or software resources as the physical resource layer. For example, the virtualization layer may include hypervisor and physical computing resources installed in each of the virtualization servers 403. Known cloud systems such as WINDOWS AZURE (Microsoft Corporation, located in Redmond, Washington), AMAZON EC2 (Amazon.com Inc., Seattle, WA), and IBM BLUE CLOUD (IBM Corporation, Armonk, NY) have.

Enterprise Mobility Management Architecture

[0075] FIG. 5 shows an enterprise mobility technology architecture 500 for use in a BYOD environment. The architecture allows a user of the mobile device 502 to access enterprise resources or personal resources using the mobile device 502 and to use the mobile device 502 for personal use. A user may access such enterprise services 508 or enterprise resources 504 using the mobile device 502 provided to the user by the enterprise or the mobile device 502 purchased by the user. The user may utilize the mobile device 502 only for business or for business and personal use. The mobile device may execute an iOS operating system, an Android operating system, and the like. The enterprise may choose to implement policies for managing the mobile device 504. These policies may be injected through a firewall or gateway to allow the mobile device to be identified, secure or secure, and selectively or globally accessible to enterprise resources. The policies may be mobile device management policies, mobile application management policies, mobile data management policies, or some combination of mobile device, application and data management policies. The mobile device 504 managed through the application of mobile device management policies may be referred to as a registration device.

[0076] The operating system of the mobile device may be separated into a managed partition 510 and an unmanaged partition 512. The management partition 510 may allow applications to be executed on the management partition and policies for securing data stored in the management partition to be applied thereto. Applications running on the management partition may be security applications. The security applications may be email applications, web browsing applications, software-as-a-service (SaaS) access applications, Windows application access applications, and the like. The security applications may be secure native applications 514, secure remote applications 522 executed by the secure application launcher 518, virtualized applications 526 executed by the secure application launcher 518, and the like. The secure native applications 514 may be wrapped by a secure application wrapper 520. The security application wrapper 520 may include integration policies that are executed on the mobile device 502 when the secure native application is executed on the device. The security application wrapper 520 is responsible for storing resources hosted at the enterprise that the secure native application 514 may require in order to complete the requested task upon execution of the secure native application 514, And may include meta-data to inform application 514. Secure remote applications 522 executed by security application launcher 518 may be executed within secure application launcher application 518. [ The virtualization application 526 executed by the security application launcher 518 may utilize resources on the mobile device 502, enterprise resources 504, and the like. The resources used on the mobile device 502 by the virtualization applications 526 executed by the security application launcher 518 may include user interaction resources, processing resources, and the like. User interaction resources can be used to collect and transmit keyboard input, mouse input, camera input, tactile input, audio input, visual input, gesture input, and the like. The processing resources may be used to present a user interface, to process data received from enterprise resources 504, and so on. The resources used in the enterprise resources 504 by the virtualization applications 526 executed by the security application launcher 518 may include user interface creation resources, processing resources, and the like. User Interface Creation Resources can be used to assemble the user interface, modify the user interface, refresh the user interface, and the like. Processing resources may be used to generate information, read information, update information, delete information, and the like. For example, a virtualization application may record user interactions associated with a GUI and communicate them to a server application, where the server application may use user interaction data as input to an application running on the server. In this arrangement, an enterprise may choose to maintain data, files, etc., associated with an application as well as an application on the server side. While the enterprise may choose to "mobilize" some of its applications in accordance with the principles herein by securing some applications for deployment on a mobile device, this arrangement may also be selected for specific applications. For example, some applications may be secured for use on a mobile device, while other applications may not be prepared or dedicated for deployment on a mobile device, You can choose to provide user access. As another example, an enterprise may be required to provide large composite applications (e.g., resource resource planning applications) with large and complex data sets that would be undesirable or otherwise undesirable to customize applications for mobile devices. And thus the enterprise can choose to provide access to the application via virtualization technologies. As yet another example, an enterprise may have applications that maintain highly secure data (e.g., human resource data, customer data, engineering data) that the enterprise may be too sensitive to even in a secure mobile environment, You may choose to use virtualization techniques to allow mobile access to these applications and data. An enterprise may choose to provide fully secured and fully functional applications on a mobile device as well as a virtualization application in order to allow access to applications that are more likely to operate on the server side. In one embodiment, the virtualization application may store some data, files, etc. on the mobile phone at one of the secure storage locations. The enterprise may choose to have certain information stored on the phone, for example, without allowing other information.

[0077] In connection with a virtualization application as described herein, a mobile device may have a virtualization application that is designed to present GUIs and then record user interactions with the GUI. The application may communicate to the server user interactions to be used by the server-side application as user interactions with the application. In response, the application on the server side can send a new GUI back to the mobile device. For example, the new GUI may be a static page, a dynamic page, an animation, or the like.

[0078] Applications running on the management partition may be stabilized applications. The stabilized applications may be managed by the device manager 524. The device manager 524 may utilize techniques for monitoring stabilized applications and for detecting and eliminating problems that would have caused unstable applications if the techniques were not utilized to detect and eliminate those problems.

[0079] Security applications can access data stored in the secure data container 528 of the management partition (510) of the mobile device. The secured data in the secure data container may be accessed by securely wrapped applications 514, applications executed by the secure application launcher 518, virtualized applications 526 executed by the secure application launcher 518, . The data stored in secure data container 528 may include files, databases, and the like. The data stored in the secure data container 528 may include data, etc., specific to the particular security application 530 that is shared between the security applications 532. Data specific to the security application may include security general purpose data 534 and high security data 538. Secure general purpose data can use high-strength encryption, such as AES 128-bit encryption, while high security data 538 can use super-enhanced encryption, such as AES 254-bit encryption. Data stored in secure data container 528 may be removed from the device upon receipt of a command from device manager 524. The security applications may have a dual-mode option 540. [ The dual mode option 540 may present the user with an option to operate the secure application in the unsecured mode. In the unsecured mode, the security applications can access data stored in the non-secure data container 542 on the unmanaged partition 512 of the mobile device 502. The data stored in the insecure data container may be personal data 544. [ The data stored in the non-secure data container 542 may also be accessed by non-secure applications 548 running on the non-administrative partition 512 of the mobile device 502. The data stored in the insecure data container 542 may be maintained on the mobile device 502 when the data stored in the secure data container 528 is removed from the mobile device 502. An enterprise may be a selected or all (or all) selected, owned or licensed or controlled by a corporation while retaining or otherwise retaining personal data, files and / or applications (personal data) owned or licensed or controlled by the user Data, files and / or applications (enterprise data) from the mobile device. This operation may be referred to as a selective wipe. When enterprise and personal data are arranged according to the examples described herein, the enterprise can perform selective wiping.

[0080] The mobile device may connect to corporate resources 504 and enterprise services 508 of the enterprise, to the public Internet 548, and the like. The mobile device may connect to enterprise resources 504 and enterprise services 508 via virtual private network connections. Virtual private network connections may be specific to particular applications 550, specific devices, specific security areas on the mobile device 552, and so on. For example, each of the applications wrapped in the security area of the phone may be associated with the enterprise resources via an application specific VPN so that they can be approved based on attributes associated with the application, along with user or device attribute information, Access. Virtual private network connections can carry Microsoft switched traffic, Microsoft Active Directory traffic, HTTP traffic, HTTPS traffic, and application management traffic. Virtual private network connections may support and enable single-sign-on authentication processes 554. [ The single-sign-on processes may allow a user to provide a single set of authentication credentials, which authentication credentials are then verified by the authentication service 558. The authentication service 558 may then authorize the user access to multiple enterprise resources 504 without requiring the user to provide authentication credentials to each individual enterprise resource 504. [

[0081] Virtual private network connections may be established and managed by the access gateway 560. The access gateway 560 may include performance enhancing features to manage, accelerate, and improve delivery of enterprise resources 504 to the mobile device 502. The access gateway can also re-route traffic from the mobile device 502 to the public Internet 548 and thus allow the mobile device 502 to access publicly available non-secure applications running on the public Internet 548 can do. The mobile device can connect to the access gateway through the transport network. The transport network can be a wired network, a wireless network, a cloud network, a local area network, a metropolitan area network, a wide area network, a public network, a private network, and the like.

[0082] Enterprise resources 504 may include email servers, file sharing servers, SaaS applications, web application servers, Windows application servers, and the like. The e-mail services may include exchange servers, Lotus Notes servers, and the like. File sharing servers may include ShareFile servers, and the like. SaaS applications can include Salesforce. Windows application servers may include some application servers that are built to provide applications intended to run on a local Windows operating system or the like. The enterprise resources 504 may be premise-based resources, cloud-based resources, and the like. Enterprise resources 504 may be accessed by mobile device 502 either directly or through access gateway 560. [ Enterprise resources 504 may be accessed by mobile device 502 over a transport network. The transport network can be a wired network, a wireless network, a cloud network, a local area network, a metropolitan area network, a wide area network, a public network, a private network, and the like.

[0083] Enterprise services 508 may include authentication services 558, threat detection services 564, device management services 524, file sharing services 568, policy manager services 570, Services 572, application controller services 574, and the like. Authentication services 558 may include user authentication services, device authentication services, application authentication services, data authentication services, and the like. Authentication services 558 may use certificates. Certificates may be stored on the mobile device 502 by corporate resources 504, and so on. Certificates stored on the mobile device 502 may be stored in an encrypted location on the mobile device and the certificate may be temporarily stored on the mobile device 502 for use in authentication, Threat detection services 564 may include intrusion detection services, unauthorized access attempt detection services, and the like. Unauthorized access attempt detection services may include unauthorized attempts to access devices, applications, data, and the like. Device management services 524 may include configuration, provisioning, security, support, monitoring, reporting and decommissioning services. File sharing services 568 may include file management services, file storage services, file collaboration services, and the like. Policy management services 570 may include device policy manager services, application policy manager services, data policy manager services, and the like. The social integration services 572 may include contact integration services, collaboration services, integration with social networks such as Facebook, Twitter and LinkedIn. Application controller services 574 may include management services, provisioning services, deployment services, assignment services, revocation services, wrapping services, and the like.

[0084] The enterprise mobility technology architecture 500 may include an application store 578. The application store 578 may include non-wrapped applications 580, pre-wrapped applications 582, and the like. Applications may be populated from application controller 574 to application store 578. The application store 578 may be accessed by the mobile device 502 via the access gateway 560, the public network 548, and the like. An application store can be provided for ease of use and ease of use when using the user interface. The application store 578 may provide access to the software deployment kit 584. The software deployment kit 584 may provide the user with the ability to secure applications selected by the user by wrapping the application as previously described in this detailed description. The wrapped application using the software deployment kit 584 may then be made available to the mobile device 502 by populating it in the application store 578 using the application controller 574. [

[0085] The enterprise mobility technology architecture 500 may include management and analysis capabilities 588. Management and analysis capabilities 588 can provide information about how resources are used, how often resources are used, and so on. Resources may include devices, applications, data, and the like. How resources are used may include which devices download which applications, which applications access which data, and so on. How often resources are used may include how often applications are downloaded, how many times a particular set of data is accessed by an application, and so on.

[0086] FIG. 6 is another exemplary enterprise mobility management system 600. Some components of the mobility management system 500 described above with reference to FIG. 5 have been omitted for simplicity. The architecture of the system 600 shown in FIG. 6 is similar in many respects to the architecture of the system 500 described above with reference to FIG. 5, and may include additional features not mentioned above.

[0087] In this case, the left side represents the registered mobile device 602 with the receiver 604, which interacts with the gateway 606 ("the cloud gateway") for the cloud-based services, Access to a variety of enterprise resources 608 and services 609 such as Exchange, Sharepoint, PKI resources, Kerberos resources, and certificate issuance services, (Not shown), mobile device 602 may also interact with an enterprise application store ("storefront") for selecting and downloading applications have.

[0088] The receiver 604 may be a user interface (UI) intermediary for Windows applications / desktops hosted in a corporate data center, accessed using a display remote protocol, such as the HDX / ICA protocol, As shown in FIG. Receiver 604 also supports the installation and management of native applications on mobile device 602, such as native iOS or Android applications. For example, the management applications 610 (mail, browser, wrapping application) shown in the preceding figures are all native applications that are executed locally on the device. The receiver 604 and the mobile application management protocol of this architecture operate to provide policy drive management capabilities and specifications, such as connectivity to corporate resources / services 608 and single sign on (SSO). An example of a mobile application management protocol is the MDX (mobile experience technology) protocol available from Citrix. Receiver 604 handles the main user authentication for the enterprise, usually an access gateway (AG) with SSO to other cloud gateway components. The receiver 604 obtains policies from the cloud gateway 606 to control the behavior of the management application 610 on the mobile device 602.

[0089] Security inter-process communication (IPC) links 612 between native applications 610 and receiver 604 are used by a management framework 614 ) To apply the policies to be enforced by the management channel. The management framework 614 may be, for example, an MDX framework available from Citrix. The IPC link 612 also allows the receiver 604 to apply credentials and authentication information to enable connection to the enterprise resources 608 and SSO. Finally, the IPC link 612 allows the management framework 614 to invoke user interface functions implemented by the receiver 604, e.g., online and offline authentication.

[0090] Communications between the receiver 604 and the cloud gateway 606 extend the management channel from the management framework 614, which essentially wraps each native management application 610. The management framework 614 requests policy information from the receiver 604 and the receiver 604 in turn requests policy information from the cloud gateway 606. [ The management framework 614 requests authentication and the receiver 604 logs into the gateway service portion of the cloud gateway 606 (which may be, for example, a NetScaler Access Gateway available from Citrix). As described more fully below, the receiver 604 may also generate input data for deriving encryption keys for local data vaults 616 or enable direct authentication to PKI protected resources Lt; RTI ID = 0.0 > 606 < / RTI >

[0091] In more detail, the management framework 614 wraps each management application 610. This can be integrated either through an explicit build phase or through a post-build processing phase. The management framework 614 may "pair" with the first launch time receiver 604 of the application 610 to initialize the secure IPC link 612 and obtain a policy for that application. The management framework 614 may include some of the suppression policies that define how the local OS services can be used or how the local OS services can interact with the application 610, You can enforce receiver login dependencies.

[0092] The management framework 614 may use the services provided by the receiver 604 over the secure IPC link 612 to facilitate authentication and internal network access. The key management of the private and shared data vaults 616 (containers) may also be managed by appropriate interactions between the management applications 610 and the receiver 604. The bolts 616 may be made available only after on-line authentication, or may be made available after off-line authentication if allowed by policy. The first use of the bolts 616 may require online authentication, and offline access may be limited to the maximum policy refresh period before online authentication is again required.

[0093] Network access to internal resources may occur directly from individual management applications 610 through the access gateway functionality of the cloud gateway 606. Management framework 614 is responsible for coordinating network access on behalf of each application 610. The receiver 604 may facilitate these network connections by providing appropriate time-limited secondary credentials obtained after on-line authentication. Reverse web proxy connections and end-to-end VPN-style tunnels 618 may be used.

[0094] The mail and browser management applications 610 have special status and may use facilities where arbitrarily wrapped applications may not be generally available. For example, the mail application may use a special background network access mechanism that allows the mail application to access the mail server (e.g., Exchange) for an extended period of time without requiring a full AG logon. Browser applications can use multiple private data vaults to separate different types of data.

[0095] Such an architecture supports the integration of various other security features. For example, in some cases, the cloud gateway 606 (including its own gateway services) may not need to verify directory service passwords, such as Active Directory (AD) passwords. In some situations it can be left at the discretion of the enterprise whether the directory service password can be used as an authentication factor for some users. The different authentication methods may be used when the user is online or offline (e.g., connected to the network or not connected).

[0096] The step-up authentication can identify the managed native applications 610 that the cloud gateway 606 is allowed to access for highly classified data requiring strong authentication, It is characterized by allowing access to these applications only after proper authentication has been performed, although this may be required by the user after the previous weak login level.

[0097] Another security feature of this solution is the encryption of data vols 616 (containers) on the mobile device 602. The vaults 616 may be encrypted to protect all on-device data including files, databases, and configurations. In the case of online vaults, keys may be stored in a server (e.g., a cloud gateway), and in the case of off-line vaults, a local copy of the keys may be protected by a user password. When data is stored locally on the device 602 in the security container 616, it is desirable that the AES 256 encryption algorithm be utilized at a minimum.

[0098] Other security container features may also be implemented. For example, a logging feature may be included in which all security events occurring in the application 610 are logged and reported back to the backend. Data wipe may be supported, e.g., if the application 610 detects tampering, the associated encryption keys may be written in random data, and thus no hint is left on the file system where the user data is destroyed. Screen shot protection is another feature that allows applications to prevent arbitrary data from being stored in screen shots. For example, the concealment characteristic of the key window may be set to YES. This allows all content currently being displayed on the screen to be hidden, thus resulting in a blank screen shot in which any content will normally reside.

[0099] Local data transfer can be prevented, for example, by preventing any data from being delivered locally to the outside of the application container, for example by copying any data or sending it to an external application. The keyboard cache feature may be operable to disable automatic correction for sensitive text fields. SSL authentication verification may be operable, so the application verifies the server SSL certificate in detail instead of being stored in the keychain. The encryption key generation feature may be used so that a key used to encrypt data on the device (if offline access is required) is generated using a passphrase supplied by the user. It can be XORed with other keys that are randomly generated and stored on the server side when offline access is not required. The key derivation functions may operate such that the keys generated from the user password use KDFs (key derivation functions, in particular PBKDF2) rather than generating a cryptographic hash of the key. The latter creates keys vulnerable to brute force attacks or directory attacks.

[0100] Additionally, one or more initialization vectors may be used in the encryption methods. The initialization vector may cause multiple copies of the same encrypted data to result in different cryptographic text output, thus preventing replay and decryption attacks. This can also prevent an attacker from decrypting any data even if the encryption key is stolen in the event that the particular initialization vector used to encrypt the data is not known. Additionally, authentication and subsequent decryption may be used, where the application data is decrypted only after the user is authenticated within the application. Other features may relate to sensitive data in memory, which may be retained in memory only when needed (not the disk). For example, login credentials may be cleared from memory after login, and other data in the encryption keys and Objective-C instance variables are not stored because these data can be easily referenced. Instead, the memory can be manually allocated for these.

An inactivity timeout may be implemented wherein the user session ends after a policy-defined period of inactivity.

[0102] Data leakage from the management framework 614 may be prevented in other manners. For example, when the application 610 is in the background, the memory may be cleared after a predetermined (configurable) time period. When backgrounded, a snapshot can be taken at the last displayed screen of the application to lock the foregrounding process. The screenshot may contain the confidential data and should therefore be cleared.

 [0103] Another security feature involves using one time password (OTP) 620 without using a directory service 622 password to access one or more applications. In some cases, some users do not know their directory service password (or are not allowed to know their directory service password) and therefore they use OTP 620 to use a hardware OTP system, such as SecurID (OTPs may also be provided by different vendors such as Entrust or Gemalto). In some cases, after the user authenticates with the user ID, the text is sent to the user along with the OTP 620. In some cases, this can only be implemented for online use if the prompt is a single field.

[0104] The offline password may be implemented for offline authentication for applications 610 that are allowed to be used offline through an enterprise policy. For example, an enterprise may want the storefront to be accessed in this manner. In this case, the receiver 604 may require the user to set a customized offline password, and the directory service password is not used. The cloud gateway 606 controls and enforces password standards for minimum length, character class composition, and password lifetime as described by these requirements, even though standard Windows server password complexity requirements may be modified. To provide the policies to do so.

[0105] Another feature relates to enabling client-side certificates for certain applications 610 as secondary credentials (for accessing PKI-protected web resources via the management framework micro VPN feature). For example, a mail application may utilize such a certificate. In this case, certificate-based authentication using a mobile data synchronization protocol (e.g., protocol used by ActiveSync) may be supported, wherein the certificate from the receiver 604 is retrieved by the cloud gateway 606, . Each management application may have an associated client certificate identified by a label defined at the cloud gateway.

[0106] The cloud gateway 606 may interact with enterprise special purpose web services to support issuing client certificates for associated management applications to authenticate internal PKI protected resources.

[0107] Receiver 604 and management framework 614 may be implemented to assist in obtaining and using client certificates for authenticating internal PKI protected network resources. For example, two or more certificates may be supported to match various levels of security and / or separation requirements. Certificates may be used by mail and browser management applications, and ultimately arbitrarily wrapped applications (if the management framework uses these applications for web service style communication patterns that are appropriate for arbitrating https requests).

Management Framework on iOS Client certificate support may rely on importing a PKCS 12 binary large object (BLOB) into each iOS keychain in each management application during each usage period. Management Framework Client certificate support can use an HTTPS implementation with private in-memory key storage. Client certificates may not be presented in the iOS keychain and may not persist, potentially excluding strongly protected "online-only" data values.

[0109] Mutual SSL can also be implemented to provide additional security by requiring the mobile device 602 to be authenticated to the enterprise, and vice versa. Virtual smart cards for authenticating to the cloud gateway 606 may also be implemented.

[0110] Both limited and full Kerberos support may be additional features. The full support feature relates to the ability to perform a full Kerberos login to the directory service 622 using a directory service password or a trusted client certificate and to obtain Kerberos service tickets to respond to HTTP negotiation authentication challenges. The limited support feature relates to constrained delegation in the AFEE, where the AFEE supports invoking the KEROS protocol transitions so that in response to the HTTP negotiation authentication challenges, the KEROS service (which is mandatory delegation) Tickets can be acquired and used. This mechanism works in reverse web proxy (also called CVPN) mode and when http (not https) connections are proxied in VPN and micro VPN mode.

[0111] Another feature involves application container locking and wiping, which occurs automatically upon jail-break or routing detection and as a pushed command from the management console And may even include remote wipe functionality even when the application 610 is not running.

[0112] Multi-site architecture or configuration of the store front and application controllers may be supported, which allows users to be served from one of several different locations in the event of failure.

[0113] In some cases, management applications 610 may be allowed to access the certificate and private key via an API (Exemplary OpenSSL). The enterprise trusted management applications 610 may be allowed to perform certain public key operations using the application's client certificate and private key. Thus, for example, when an application operates as a browser and no certificate access is required, when an application reads a certificate for "who am I", when an application uses a certificate to establish a secure session token, When using private keys for digital signatures (e. G., Transaction logs) for this critical data or for temporary data encryption, a variety of use cases can be identified and processed.

Identification of Management Mobile Applications

[0115] In FIG. 7, an exemplary mobile device management system 700 is shown. The system 700 may be similar in many aspects to the systems 500 and 600 previously described with reference to Figures 5 and 6, respectively. The system 700 may also omit certain components described above for simplicity and may include additional features not previously discussed.

The mobile device management system 700 may include an enterprise system 702 in signal communication with one or more mobile devices 704 via a network 706. The enterprise system may include one or more computing resources, such as enterprise application server 708, access gateway 710, and enterprise resources 712.

[0117] Enterprise application server 708 may be similar in many aspects to application store 578 discussed above with reference to FIG. Enterprise application server 708 may provide access to mobile applications 714 that are available for installation on a mobile device, e.g., mobile device 704. [ As mentioned above, mobile applications 714 may include both secure mobile applications and non-secure mobile applications. Accordingly, the mobile applications 714 may correspond to the non-wrapped applications 180 and pre-wrapped applications 182 described above with reference to FIG. As also noted above, a secure mobile application can be wrapped in a secure application wrapper, and the secure application wrapper manages the secure mobile application and controls the execution of the secure mobile application. In this regard, a secure mobile application, a wrapped mobile application, or a registered mobile application may also be referred to as a management mobile application.

[0118] Enterprise application server 708 may also provide access to application policies 716 and application metadata 718 associated with mobile applications 714, respectively. Application policy 716 may represent a mechanism of one of the mechanisms by which management of the mobile application is realized. As discussed above, application policy 716 may include information such as which users can utilize a managed mobile application, which computing resources the management mobile application can access, specifications available in the managed mobile application when running on the mobile device , And combinations and combinations thereof.

[0119] Application metadata 718 refers to information that describes and / or identifies a mobile application. The application metadata 718 may be created during the build process of the new mobile application and made available through the enterprise application server 708 when a new mobile application is published to the enterprise application server. The application metadata 718 may include, for example, the name of the mobile application, the size of the mobile application, the unique identifier for the mobile application, the version of the mobile application, and so on. As discussed further below, application metadata 718 may also include information useful for verifying the identity of the mobile application.

[0120] The access gateway 710 may facilitate access to enterprise resources 712 by a mobile device, for example, a management mobile application operating in the mobile device 704. The access gateway 710 may be similar in many aspects to the access gateway 160 and the cloud gateway 606 previously described with reference to Figures 5 and 6, respectively. Enterprise resources 712 may correspond to enterprise services 508 and 609 as well as enterprise resources 504 and 608, each of which is also described above with reference to Figures 5 and 6, respectively. Once verified, authenticated and licensed, mobile applications can access corporate resources 712 via access gateway 710 as described above.

[0121] Management mobile applications 720 as well as unmanaged mobile applications 722 may all reside in mobile device 704. The access manager application 724 may also reside on the mobile device 704 and may manage the execution of the management mobile applications 720 on the mobile device. A mobile device, including both a management mobile application and an unmanaged mobile application, may be referred to as an unmanaged mobile device because the enterprise only has the ability to control the managed mobile applications of the mobile device, Because they may not be equipped to control other aspects of the system. Because the mobile device 704 includes a management mobile application 720 and unmanaged mobile applications 722, the mobile device shown as an example in FIG. 7 may be referred to as an unmanaged mobile device, Device. ≪ / RTI >

[0122] The access manager application 724 ("access manager") may be similar in many aspects to the receiver 604 discussed above with reference to FIG. As discussed further below, access manager 724 may manage user authentication, verification of mobile application identity, and enforcement of mobile application policies. The user may access the enterprise application server 708 to initially download and install the access manager 724 to the mobile device 704 (e.g., via a web browser). As discussed above, access manager 724 also acts as an interface to enterprise application server 708, which enables a user to browse, download, and install mobile applications that are available for purchase from enterprise system 702 .

When the user downloads the management mobile application 720 to the mobile device 704, the access manager 724 also includes application metadata 718 associated with the management mobile application 720, as well as application metadata 718 associated with the management mobile application 720 Any application policies 716 may be downloaded. As discussed above, the access manager 724 may receive application metadata 718 for the mobile application 720 from the enterprise application server 708. In some example implementations, the access manager 724 may provide application metadata (e. G., Data) to the secure location of the mobile device 704, e. G., To the secure data container 528 of Fig. 5 and / or secure data vols 616 of Fig. Gt; 718 < / RTI > and application policies 716. < RTI ID =

[0124] Access manager 724 may also include a list 726 of managed mobile applications currently installed in mobile device 704 and under the management of an access manager. Upon installation of the new management mobile application, the access manager 724 may add a new entry to the management mobile application list 726. [ A new entry in the list 726 may correspond to a new managed mobile application installed on the mobile device 704. [

[0125] As mentioned above, the access manager 724 may, for example, ensure that the management mobile application has correctly identified itself and / or that the management mobile application has not been changed since it was installed on the mobile device 704 And to verify the identity of the management mobile application 720, The access manager may rely on the identification information 728 included in the application metadata 718 to verify the identity of the management mobile device 720. [ In some exemplary embodiments, the access manager 724 may rely on the mobile platform in which the management mobile application 720 is operating to verify the identity of the management mobile application. The operating system of the mobile platform may generate stored identification information for the management mobile application and identification information that the access manager 724 can compare. If the stored identification information matches the identification information received from the operating system, the access manager 724 identifies the management mobile application 720 as a trusted mobile application and authorizes access to enterprise resources 712 have. If the stored identification information for the management mobile application does not match the identification information received from the operating system, then the access manager 724 identifies the management mobile application 720 as a suspicious or untrusted mobile application, 712). ≪ / RTI > As noted above, access manager 724 may also grant or deny access to local computing resources in mobile device 704 itself. Local computing resources of mobile device 704 may include, for example, a camera or other recording hardware; Location-based services such as GPS, network services such as cellular or Internet services, communication services such as Bluetooth, interface commands such as cut-and-paste and screen shot specifications. have.

In other exemplary embodiments, the access manager 724 may challenge the management mobile application 720 to identify the management mobile application 720 itself. Access manager 724 may issue a challenge request to management mobile application 720 and determine an expected challenge response. The expected challenge response is the response that is expected to be received from the management mobile application that correctly identified itself and was not changed. As will be further described below, only mobile applications that correctly identify themselves and have not changed will be able to generate the expected challenged response. If the response received from the management mobile application 720 matches the expected response, the access manager 724 may identify the management mobile application 720 as a trusted mobile application. If the management mobile application 720 has been identified as a trusted mobile application, the access manager may provide credentials to the management mobile application that are required to access the enterprise resources 712. If the response received from the management mobile application 720 does not match the expected response, the access manager can identify the management mobile application as a suspicious or untrusted mobile application and access to corporate resources 712 Can be rejected. Again, the access manager 724 may grant or deny access to the mobile device 704's local computing resources depending on whether the response received from the management mobile application 720 matches the expected response .

[0127] The expected response may be based, at least in part, on the identification information 728 contained in the application metadata 718 associated with the management mobile application 720. The identification information may be generated when the mobile application itself is created. The identification information may be, for example, the original digital certificate or original information that may be used to generate the application signature. Thus, the expected response may include identification information 728 or otherwise correspond to identification information 728. [ As described further below, a mobile application that submits a mobile application or a false identity that is subsequently modified may not be able to generate the expected response and thus gain access to the computing resources.

[0128] Various approaches for verifying the identity of the management mobile application can optionally be used. The particular approach ultimately implemented may depend on the operating system and mobile platform of the mobile device 704. For example, the Android operating system available from Google Inc., located in Mountain View, Calif., May include mechanisms that enable the access manager to strongly identify mobile applications requesting access to computing resources. Those skilled in the art will appreciate that there are built-in mechanisms for requesting the signing certificate of the application that the access manager 724 may utilize to verify the identity of the management mobile application requesting access to computing resources such as enterprise resources 712 You will recognize that the Android operating system may include. It will also be appreciated that the Android operating system can prevent the application from changing after installation and prevent the mobile application from using the generated signing certificate for different mobile applications. In this manner, the access manager 724 may rely on signature certificates provided by the operating system of the mobile platform to verify the identity of the management mobile application. Verifying the application identity using signature certificates will be discussed in further detail below.

However, other operating systems may not include built-in mechanisms in which access manager 724 may rely on verifying the identity of the management mobile application requesting access to computing resources. For example, an iOS operating system available from Apple Inc. located in Cupertino, Calif., May not include mechanisms for requesting a signing certificate for a managed mobile application. Moreover, the methods available for inter-process communication in iOS may not include mechanisms for verifying the identity of mobile applications at each end of the communication. Mobile applications running on the iOS platform can exchange communications, for example, via a copy-and-paste procedure, through an agreed-to-URL scheme, or over a network.

[0130] In some example implementations, the access manager 724 and the management mobile application 720 may be configured to communicate over a network, for example, via a transmission control protocol (TCP). In this example, the access manager 724 may wait to open a TCP socket and receive a connection request from the management mobile application 720. However, it will be appreciated that TCP does not include a mechanism for identifying a management mobile application requesting a connection to access manager 724. [ Since the iOS platform may not include a mechanism to obtain a signing certificate for the requesting mobile application, additional steps may be used to verify the identity of the requesting mobile application. Instead of relying on the signing certificate, in this example, the access manager 724 may include an identification information 732 embedded in the management mobile application 720 and / or derived from the management mobile application 720, At least partially.

[0131] The lapping process discussed above can configure a mobile application to act as a management mobile application. In this regard, the wrapping process may include a management framework 730 in the management mobile application 720 (e.g., inserting, embedding, and wrapping the management framework 730 in the management mobile application 720) Etc.). The management framework 730 may correspond to the security application wrapper 120 and the management framework 614 discussed previously with reference to Figures 5 and 6, respectively. As discussed above with reference to FIG. 6, the management framework 730 enables the access manager 724 to manage the operation of the mobile application 720.

[0132] The management mobile application 720 may also use the management framework 730 to identify itself to the access manager 724. In particular, the management framework 730 may generate a response to the challenge raised by the access manager 724 during the identity verification procedure.

[0133] In some exemplary implementations, the management framework 730 of the management mobile application 720 may be configured to generate an application signature. The management framework 730 may also be configured to provide a challenge response based at least in part on such application signatures. In turn, the application signature may be based on the identification information 732 embedded in the management mobile application 720 and / or derived from the management mobile application 720. In other words, the management framework 730 may generate application signatures based on static information and dynamic information associated with the management mobile application 720. [

[0134] The static information may be secret information embedded in the management mobile application 720 during the wrapping process described above. For example, the secret information may include one or more identification tokens 734 embedded in the application during the wrapping process. The identification tokens 734 may be randomized alphanumeric strings embedded in the binary of the management mobile application 720, for example. Management framework 730 may be configured to extract identification tokens 734 when configuring an application signature to respond to a challenge received from access manager 724. [

[0135] The dynamic information may be identification tokens derived from the management mobile application 720. For example, the derived identification tokens may be hash values obtained using selective hash functions on various components of the mobile application bundle, such as mobile application binaries, application icons, application frameworks, and so on. Access manager 724 may derive this dynamic identification information in ad hoc format during the identity verification procedure. The one or more optional hash functions may be used to generate one or more optional hash values representing the derived identification tokens. The access manager may utilize the management framework 730 to assist in deriving the dynamic identification information from the management mobile application 720 as needed.

The management framework 730 may also be configured to configure an application signature used in response to the challenge received from the access manager 724. [ Application signatures may include a combination of dynamic information derived from the management mobile application 720 as well as dynamic information derived from the management mobile application 720. [ Management framework 730 may be further configured to arrange static and dynamic information in an application signature in a particular manner. Thus, the management mobile device 720 can be strongly identified through static information embedded in the management mobile application, dynamic information derived from the mobile application, and an array of static and dynamic information within the application signature.

[0137] As discussed above, access manager 724 may be configured to generate an expected response when challenging management mobile application 720. Thus, the access manager 724 may be similarly configured to configure the expected application signature. The access manager 724 may configure the expected application signature based on the identification information 728 contained in the application metadata 718 for the management mobile application 720. [ The access manager may also be configured to dynamically derive dynamic information from the management mobile application 720. [ In addition, the access manager 724 may be similarly configured to arrange static and dynamic information within the expected application signature in a particular manner.

To protect against replay attacks, the access manager 724 provides the management mobile application 720 with a nonce (eg, any number and random number) for use in response to the challenge . Access manager 724 may hash the nonce using the expected application signature to obtain the expected hash value. Similarly, the management framework 730 of the management mobile application can hash the application signature using the received nonce to obtain the response hash value. Thus, in response to a challenge from the access manager 724, the management mobile application 720 can provide the access manager with the computed hash value obtained from the application signature and the nonsense received from the access manager. Thus, the access manager can compare the expected hash value with the received hash value. Thus, the access manager 724 can identify the management mobile application 720 as a trusted mobile application when the expected hash value matches the received hash value.

[0139] Referring now to FIG. 8, a block diagram of an exemplary application signature and challenge response is shown. As discussed above, the management mobile application 800 may generate an application signature 802 in response to a challenge from the access manager 804. The application signature 802 may include identification tokens 806 embedded in the management mobile application 800 as well as identification tokens 808 derived from the management mobile application. 8, the management mobile application 800 may arrange embedded identification tokens 806 and derived identification tokens 808 in an application signature 802 in a particular manner. By way of example, the management mobile application 800 may concatenate embedded identification tokens 806 and derived identification tokens 808 in a particular order to construct an application signature. In another example, management mobile application 800 may concatenate portions of embedded identification tokens 806 and portions of derived identification tokens 808 to configure an application signature. It will be appreciated that various approaches for configuring application signatures may optionally be used. As also noted above, the access manager 804 may provide the management 810 to the management mobile application 800. The management mobile application 800 may use the hash function 812 to generate the hash value 814 based on the application signature 802 and the nonsense 810. [ The management mobile application 800 may provide the hash value 814 to the access manager 802 as a response 816 to the received challenge.

In order to verify the identity of the management mobile application 800, the access manager 804 includes identification tokens 820 stored with the application metadata 822 and identification tokens 808 derived from the management mobile application, The application signature 818 can be configured based on the expected application signature 818. < RTI ID = 0.0 > The access manager 804 may also use the hash function 812 to generate the expected hash value 824 based on the nonsense 810 and the identification tokens 820 from the application metadata 822. [ In response to the challenge, the access manager 804 may receive the challenge response 816 and compare the expected hash value 824 with the hash value 814 of the challenge response.

With the benefit of this disclosure, it will be appreciated that only the unmodified mobile application received from the enterprise application server (708 in FIG. 7) can generate the expected hash value 824. It will also be appreciated that the expected application signature 818 may not be permanently stored on the mobile device, but rather may be reconfigured as needed to verify the identity of the mobile application 800 requesting access to computing resources. Thus, the approach presented above represents a mechanism for strongly identifying a mobile application to determine whether to approve or reject mobile application access to computing resources.

[0142] FIGS. 9-14 illustrate exemplary method steps associated with aspects of verifying the identity of a managed mobile application, once enforced, enforcing application policies, and controlling operations of managed mobile applications.

[0143] In FIG. 9, a flowchart 900 of exemplary method steps for managing a mobile application on an unmanaged mobile device is shown. An enterprise may be configured to operate in a mobile device (e.g., an unmanaged mobile device) and create a managed mobile application configured to access computing resources from the mobile device (block 902). The enterprise may also configure the management mobile application to be managed by the access manager application on the mobile device. As discussed above, an enterprise may either wrap a management framework (e.g., the MDX framework) that enables the access manager to verify the identity of the management mobile application and control the operation of the management mobile application, Framework. ≪ / RTI >

[0144] Upon creation of the management mobile application, the enterprise may also generate identification information associated with the management mobile application (block 904). The identification information may be, for example, application metadata including identification tokens and / or a signed application certificate. The identification tokens may be embedded in a management mobile application (e.g., application binary), in some example implementations. The user may download and install the access manager on the mobile device (block 906). The access manager may provide an interface for a user to browse an enterprise application server (e.g., an enterprise application store) and select various managed mobile applications to download to the mobile device. The access manager may require the user to provide access credentials to log on to the enterprise application server. A user may be associated with a user profile, and a user profile may be associated with various rights and entitlements. In this manner, the management mobile applications presented to the user as available for download will depend on the rights and entitlements assigned to the user, for example, the enterprise application server will only be able to provide management mobile applications Can be presented.

[0145] If the management mobile application is selected, the user can download the mobile application through the access manager and install the mobile application in the mobile device (block 908). The enterprise application server can also provide identification information associated with the mobile application as well as access policies associated with the mobile application. Thus, when a user downloads and installs a management mobile application, the access manager may also download and store the identification information (block 910) and download and store the application policy associated with the mobile application (block 912).

[0146] If a mobile application is installed on a mobile device, the user can utilize the mobile application to access the computing resource. When the mobile application attempts to access the computing resource, the mobile application may check in with the access manager to request access to the resource (block 914). Upon receiving the request to access the computing resource, the access manager may retrieve the identification information received from the enterprise application server and stored on the mobile device (block 916). The access manager may also receive identification information from a mobile operating system, e.g., a signed application authentication, or from a hash value based at least in part on the mobile application itself, e.g., an application signature (block 918).

[0147] Thereafter, the access manager may compare the stored identification information with the received identification information (block 920). If the received identification information matches the stored identification information (block 922: Y), the access manager may determine that the mobile application is valid and identify the mobile application as a trusted mobile application. Thus, the access manager may allow the management mobile application to access the computing resources (block 924). The access manager may provide the mobile application with access credentials, certificates, keys, and the like, which are needed, for example, to establish a connection with enterprise resources and to access corporate resources. In some exemplary implementations, an application policy associated with a mobile application may determine how the mobile application accesses and uses the computing resource. If the received identification information does not match the stored identification information (block 924: N), the access manager may determine that the mobile application is invalid and may not identify the mobile application as a trusted mobile application, The application may be prevented from accessing the computing resource (block 926).

[0148] FIG. 10 is a flow diagram 1000 of exemplary method steps for preparing a management mobile application for management operations, in an unmanaged mobile device. As noted above, some mobile operating systems may not provide built-in mechanisms that an access manager may use to verify the identity of a mobile application. Thus, a mobile application can be configured to strongly identify itself. The enterprise may use a toolkit to prepare the mobile application as a management mobile application (block 1002). The toolkit may add functionality (e.g., MDX framework) to convert the mobile application to a management mobile application (block 1004). The toolkit may also generate and embed identification tokens (e.g., randomized strings) into the management mobile application (block 1006). The functionality added to the management mobile application may include functionality that enables the management mobile application to extract, arrange, and combine embedded identification tokens to configure the application signatures. The functionality added to the management mobile application also includes the ability to enable the management mobile application to dynamically derive the identification tokens as well as to combine the derived identification tokens with the embedded identification tokens when configuring the application signatures can do. In addition, the functionality added to the management mobile application may additionally include functionality that enables the management mobile application to generate the hash value based at least in part on the application signature.

[0149] The toolkit may also generate application metadata for a managed mobile application that includes identification tokens embedded in the mobile application (block 1008). The enterprise may then publish the management mobile application to the enterprise application server along with application metadata and any application policies associated with the mobile application (block 1010). The enterprise application server may receive a request from the mobile device to download the selected mobile application (block 1012). If the access manager has not yet been installed on the mobile device (block 1014: N), the enterprise application server may first download the access manager application to the mobile device (block 1016). Once the access manager is installed in the mobile application (block 1014: Y), the enterprise application server may download 1018 the selected mobile application to the mobile device in response to receiving the request 1018. As mentioned above, The application server may also download application metadata associated with the selected mobile application to the mobile device for storage on the mobile device. The access manager may have access to the application metadata, The identity of the mobile application can be verified.

[0150] In FIG. 11, a flowchart 1100 of exemplary method steps for initializing a managed mobile application at an unmanaged mobile device is shown. When the mobile device is first activated and initialized (block 1102), the access manager application may be one of the first mobile applications launched (block 1104). The access manager may launch automatically, e.g., as part of the startup process of the mobile device and / or in response to user input received at the mobile device. When the access manager application launches, the access manager may request access credentials (e.g., user name and password) from the user (block 1106). The access manager may then provide access credentials for authentication to the enterprise server (block 1108). If the enterprise server does not authenticate the user (block 1110: N), the access manager may prevent any managed mobile applications of the mobile device from accessing the computing resources (block 1112). For example, the access manager may not provide mobile applications with the access credentials needed to establish connections with enterprise resources.

[0151] If the enterprise server authenticates the user (block 1110: Y), the enterprise server may verify the identity of the access manager itself to prevent the access manager application from changing (block 1114). The enterprise server can verify the identity of the access manager in the same manner as the management mobile application. By way of example, the signing certificate used to sign the access manager may be used to verify the access manager application. For example, an enterprise system can verify a management mobile application. If the access manager is not verified (block 1116: N), the management framework of the management mobile applications may consider the access manager as being lost from the mobile device, and therefore the management mobile applications may not be able to access the computing resources (Block 1112).

[0152] If the enterprise server verifies the identity of the access manager application (block 1116), then the management mobile application may be started (block 1118). During the launch as well as during operation, the mobile application can check-in to the access manager so that the access manager can verify the identity of the management mobile application (block 1120). If the access manager can not verify the identity of the management mobile application (block 1122: N), the access manager may prevent the management mobile application from accessing the computing resources (block 1124). If the access manager successfully verifies the identity of the management mobile application (block 1122: Y), the access manager may identify the management mobile applications as a trusted mobile application (block 1126). If only the management mobile application has launched to the mobile device, the access manager may update the list of mobile applications managed by the access manager to include the trusted mobile application (block 1128). If verifying the identity of the management mobile application, the access manager may also allow the trusted mobile application to access the computing resources (block 1130).

[0153] FIG. 12 shows a flow diagram 1200 of exemplary method steps for verifying a managed mobile application of an unmanaged mobile device with a mobile operating system of a first type. In this example, the mobile operating system may not include built-in mechanisms that the access manager may utilize to verify the identity of the mobile application. The access manager may receive from the management mobile application a request to access the computing resource (block 1202). Upon receiving the request, the access manager may initiate a handshake with the managing mobile application to begin the identity verification process (block 1204). The management mobile application may identify itself to the access manager by, for example, providing a unique application identifier to the access manager (block 1206). In turn, the access manager may utilize the application identifier to retrieve application metadata associated with the mobile application (block 1208). The access manager may also generate nonce and provide nonce to the mobile application (block 1210).

[0154] Thereafter, the access manager and the management mobile application may begin the process of verifying the identity of the mobile application and configuring the application signature and corresponding hash value used to determine whether the mobile application is a trusted mobile application . The mobile application may extract the embedded identification tokens (block 1212) and derive the derived identification tokens used to construct the application signature (block 1214). The mobile application may then combine and combine the extracted embedded identification tokens with the derived identification tokens to obtain the application signature (block 1216). The mobile application may compute the hash value using the nonsense and application signatures received from the access manager (block 1218).

[0155] If provided to the mobile application, the access manager may retrieve the embedded identification tokens from the application metadata associated with the mobile application (block 1220). The access manager may similarly derive the derived identification tokens used to construct the expected application signature from the mobile application (block 1222). The access manager may then combine and combine the retrieved identification tokens and derived identification tokens from the application metadata to obtain the expected application signature (block 1224). The access manager may compute the expected hash value using the nonsense and expected application signatures provided to the mobile application (block 1226).

[0156] If the retrieved embedded identification tokens from the application metadata are identical to the embedded identification tokens extracted from the mobile device; If the identification tokens derived by the access manager are identical to the identification tokens derived by the mobile; If the expected application signature configured by the access manager is the same as the application signature configured by the mobile application and if the mobile application uses the nonce provided by the access manager to compute the hash value, It will be appreciated that the hash value must be the same as the hash value computed by the mobile application. Accordingly, the mobile application may provide a hash value in response to the access manager (block 1228), and the access manager may compare the expected hash value with the value received from the mobile application (block 1230). If the expected hash value does not match the received hash value (block 1232: N), the access manager can determine that the mobile application has identified itself as false and has changed since it was installed on the mobile device . As a result, the access manager may reject the mobile application access to computing resources (block 1234). If the expected hash value matches the received hash value (block 1232: Y), the access manager can identify the mobile application as a trusted mobile application and allow the trusted mobile application to access the computing resources (Block 1236).

 [0157] FIG. 13 shows a flow diagram 1300 of exemplary method steps for verifying a managed mobile application in an unmanaged mobile device having a second type of mobile operating system. In this example, the mobile operating system may include built-in mechanisms that the access manager may utilize to verify the identity of the mobile application. The access manager may receive a request from the management mobile application to access the computing resource (block 1302). The access manager may request a unique application identifier for the mobile application from the mobile operating system (block 1304) and may receive the application identifier in response (block 1306).

[0158] Based on the application identifier for the mobile application, the access manager may query 1308 the list of managed mobile applications. If the list of managed mobile applications does not include a mobile application requesting access to the computing resource (block 1310: N), the access manager may reject the mobile application access to the resource (block 1312) . However, if the list of managed mobile applications includes a mobile application requesting access to a computing resource (block 1310: N), the access manager may request an application certificate for the mobile application from the mobile operating system (Step 1314).

[0159] As mentioned above, the enterprise application server can provide application certificates for mobile applications installed on mobile devices. The application certificates may be stored in a secured storage location of the mobile device accessible by the access manager. Accordingly, the access manager may receive the requested application certificates (block 1316) from the mobile operating system (block 1316) and retrieve the stored application certificates provided by the enterprise application server (block 1318). In some exemplary implementations, the access manager may compute individual hash values for each of the certificates using, for example, an SHA-1 hash function (block 1320). The access manager may compare the hash value of the certificates received from the mobile operating system with the hash value of the stored certificate (block 1322). If the hash values are matched (block 1324: Y), the access manager may determine that the mobile application is a trusted mobile application and allow the mobile application to access the computing resources (block 1326). If the hash values are not matched (block 1324: N), the access manager may determine that the mobile application is an untrusted mobile application and may reject the mobile application access to the computing resources (block 1312).

[0160] In FIG. 14, a flowchart 1400 of exemplary method steps for enforcing application policies during operation of a managed mobile application is shown. As noted above, enterprise application servers can provide application policies associated with managed mobile applications installed on mobile devices. The enterprise may periodically update the application policies so that the access manager can be configured to store the latest and latest application policies in the mobile device before allowing the management mobile application to access the computing resources. In this way, an enterprise can approve or revoke qualifications for applications and application functions.

[0161] After the access manager verifies the identity of the management mobile application (block 1402), the access manager may retrieve the application policy associated with the management mobile application and stored on the mobile device (block 1404). The access manager may then query the enterprise application server for policy information associated with the application policy, e.g., policy date, policy version number, and so on (block 1406). Based on the policy information received from the enterprise application server, the access manager may determine whether the application policy stored on the mobile device is current policy (block 1408). By way of example, the access manager may compare the policy date or policy version received from the enterprise application server with the policy date or policy version of the application low amount stored on the mobile device. If the policy date or policy version does not match, the access manager may determine that the application policy stored on the mobile device is not current policy (block 1408: N). If the policy date or policy version matches, the access manager may determine that the application policy stored on the mobile device is current policy (block 1408: Y).

[0162] If the application policy is not the current policy (block 1408: N), the access manager may retrieve the current policy associated with the mobile application from the enterprise system, eg, the enterprise application store (block 1410). The access manager may download the current application policy and store the current application policy in the secure storage location of the mobile device (block 1412). Once the access manager has acquired the current policy for the mobile application, the management mobile application may refer to the application policy to determine whether it can access or use the intended computing resource (block 1414 )).

[0163] The management framework may configure the management mobile application to query policies, for example, before accessing or using computing resources. By way of example, the framework may configure the management mobile application to query the application policy to determine whether data can be copied to other mobile applications of the mobile device. In some exemplary implementations, the management mobile application may only copy data to other management mobile applications of the mobile device. As another example, the framework may configure the management mobile application to query the application policy to determine if the mobile device can capture a screenshot of the management mobile application. These and other examples will be recognized with the benefit of this disclosure.

[0164] If the application policy permits the management mobile application to access or use the intended computing resource (block 1416: Y), the framework allows the management mobile application to perform the intended action (Block 1418). However, if an application policy does not allow the management mobile application to access or use the intended computing resource (block 1418: N), the framework may prevent the management mobile application from performing the intended action (Block 1420).

Mobile device management and mobile application management

Although Mobile Application Management (MAM) has been discussed with respect to unmanaged devices, aspects of the present disclosure may also be used for managed devices as well. An enterprise can utilize Mobile Device Management (MDM) with mobile application management to further control the operation of the mobile device. In particular, the mobile device may register with the MDM system to establish a management relationship between the MDM system and the mobile device. Once the mobile device is registered, the MDM system may leverage the management relationship to enforce policies, monitor the mobile device, push information to the mobile device, and so on.

In summary, the MDM system can obtain information about a mobile device that is otherwise unavailable when there is no management relationship. This information may correspond to device-level settings that are not discoverable or readable through the applications of the mobile device. These device-level settings may include PIN or password settings, encryption settings, network-related settings, and the like. This information may also include information about processes currently running on the mobile device and mobile applications installed on the mobile device (e.g., an application directory). The MDM system may additionally obtain additional or alternative types of information regarding the management mobile device. The MDM system may compare various policies with information obtained from the management mobile device and take various actions in response.

[0168] For a device PIN / password, the MDM system may obtain information indicating whether the device is secured via a PIN / password, the complexity of the PIN / password, and the lifetime of the PIN / password. Through the management relationship, the MDM system can obtain information about the PIN / password settings of the device. The MDM system can compare this information with policies that control the use of device PINs / passwords. By way of example, if the information obtained from the mobile device indicates that the security policy indicates that the mobile device should be secured by a PIN / password and that the device PIN / password setting is not enabled, the MDM system sends the device PINs / To the management mobile device. ≪ RTI ID = 0.0 > [0040] < / RTI > As another example, if the MDM system determines that the device PIN / password does not meet the complexity requirements of the security policy, the MDM system sends a notification indicating that a new, more complex PIN / password is required to comply with the security policy, As shown in FIG. As a further example, if the security policy indicates that device PINs / passwords should be periodically changed, the MDM system sends a notification indicating the need to change the device PIN / password when determining that the current device PIN / password has expired. Can be pushed to the device.

[0169] For encryption settings, the MDM system may also obtain information indicating whether hardware encryption is enabled in the device. Through the management relationship, the MDM system can enable hardware encryption of the management mobile device when the security policy requires hardware encryption and hardware encryption is not currently enabled in the mobile device. The MDM system may also set network-related settings to the management mobile device via the management relationship.

[0170] The MDM system may further obtain information about the processes currently running on the management mobile device. The MDM system can compare execution processes with lists of malicious applications, programs or processes, for example, to identify malware on a managed mobile device. Through the management relationship, the MDM system can delete any processes identified as malware or potentially malicious. The MDM system may also remove corresponding malicious applications or programs through a management relationship with the mobile device.

Similarly, the MDM system may obtain a list of applications installed on the management mobile device. The MDM system can compare a list of installed applications with, for example, an application whitelist or an application blacklist. The application whitelist can be a list of mobile applications that are allowed to be installed on the mobile device. If the list of installed applications contains an application that is not in the mobile application whitelist, the MDM system may leverage the managed relationship to remove the application. The application blacklist may be a list of mobile applications that are prohibited from being installed on the mobile device. If the list of installed applications includes an application in the mobile application blacklist, the MDM system may leverage the management relationship similarly to remove the application. It will be appreciated that the MDM system may leverage additional management relationships to push mobile applications to the management mobile device to control which mobile applications are installed on the mobile device. In view of this disclosure, it will also be appreciated that the MDM system can more robustly control mobile applications installed in mobile devices. As described above, the MAM may disable the mobile application installed on the mobile device when the application determines that the policy is violated. When the MDM is used with the MAM, but the mobile application can not just be disabled, the MDM can be removed entirely from the mobile device. The MDM system may push other types of information to the management mobile device. For example, the MDM system may leverage a management relationship to push application updates or certificates to a mobile device. Certificates may be, for example, X.509 device certificates.

 The disclosure provided in this disclosure provides a number of technical advantages. In general, the approaches presented above enable companies to securely identify mobile applications, regardless of their mobile platform. The approaches presented above also provide an automated way to verify the identity of mobile applications accessing potential sensitive data, such as authentication credentials, digital certificates, corporate data, and the like. Companies implementing the above-described approaches can also reduce the number of physical devices under corporate control by allowing individuals to access corporate resources using their personal devices. In this regard, an enterprise can avoid registering an entire device in a mobile device management system, and instead can simply register various mobile applications in a mobile device in a mobile application management system. These and other advantages will be recognized in connection with the foregoing disclosure and advantages.

Although the subject matter has been described in language specific to constitutive features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above Should be understood. Rather, the specific features and acts described above are described as exemplary implementations of the following claims.

Claims (20)

A method for managing access to corporate resources,
Operating an access manager of the mobile computing device;
Validating a mobile application installed on the mobile computing device using the access manager;
Preventing the mobile application from accessing the computing resource when the verification of the mobile application by the access manager fails;
Identifying the mobile application as a trusted mobile application when the verification of the mobile application by the access manager is successful;
Allowing the trusted mobile application to access the computing resource; And
Storing identification information associated with a mobile application of the mobile computing device,
Wherein verifying the mobile application comprises verifying the mobile application based on stored identification information,
Challenging the mobile application to provide a response identifying the mobile application;
Generating an expected response based at least in part on the stored identification information;
Comparing the expected response with a response provided by the mobile computing device;
Determining that the mobile application is valid when the expected response matches a response provided by the mobile application; And
Determining that the mobile computing device is invalid when the expected response does not match the response provided by the mobile application
The method comprising the steps of: delete delete The method of claim 1, further comprising: embedding identification tokens in the mobile application before the mobile application is installed on the mobile computing device;
Configuring the mobile application to extract embedded identification tokens;
Further comprising the step of including the embedded identification tokens in the stored identification information such that the expected response is based at least in part on the embedded identification tokens; And
Wherein the response provided by the mobile application is based at least in part on the embedded identification tokens extracted from the mobile application. 5. The method of claim 4, wherein verifying the mobile application comprises:
Deriving one or more identification tokens from the mobile application using the access manager;
Generating an expected application signature based on an arrangement of the embedded identification tokens and the derived identification tokens; And
Further comprising generating the expected response based at least in part on the expected application signature. ≪ RTI ID = 0.0 >< / RTI > 6. The method of claim 5, wherein verifying the mobile application comprises:
Providing a nonce to the mobile application;
Computing the expected hash value using the expected application signature and the nonce; And
Wherein the expected response is the expected hash value. 2. The method of claim 1, wherein the stored identification information is an original digital certificate generated for the mobile application upon creation of the mobile application. 8. The method of claim 7, wherein verifying the mobile application comprises:
Computing a first hash value based on the original digital certificate and computing a second hash value based on a digital certificate received from a mobile operating system of the mobile computing device;
Comparing the first hash value with the second hash value;
Determining that the mobile application is valid when the first hash value matches the second hash value; And
And determining that the mobile computing device is invalid when the first hash value does not match the second hash value. 2. The method of claim 1, further comprising: using the access manager to open a Transmission Control Protocol (TCP) socket of the mobile computing device;
Waiting for the mobile application to establish a connection with the access manager to the TCP socket; And
Wherein the access manager initiates verification of the mobile application when the mobile application establishes a connection with the access manager in the TCP socket. 2. The method of claim 1, further comprising: obtaining an application policy associated with the trusted mobile application;
Storing the application policy in the mobile computing device; And
Further comprising using the access manager and controlling operation of the trusted mobile application based on the application policy. As a mobile computing device,
A mobile application configured to access computing resources;
Stored identification information associated with the mobile application;
And an access manager configured to verify the mobile application based on the stored identification information; And
The access manager,
Prevent the mobile application from accessing the computing resource when verification of the mobile application fails;
Identify the mobile application as a trusted mobile application when the verification of the mobile application is successful;
Further configured to allow the trusted mobile application to access the computing resource;
Wherein the verification of the mobile application by the access manager comprises:
Challenge the mobile application to provide a response identifying the mobile application;
Generate an expected response based at least in part on the stored identification information;
Compare the expected response with a response provided by the mobile application;
Determine that the mobile application is valid when the expected response matches a response provided by the mobile application; And
The mobile computing device determining that the mobile computing device is invalid when the expected response does not match the response provided by the mobile application. delete 12. The mobile device of claim 11, wherein the mobile application comprises embedded identification tokens and is configured to extract the embedded identification tokens;
The stored identification information includes the embedded identification tokens such that the expected response is based at least in part on the embedded identification tokens; And
Wherein the response provided by the mobile application is based at least in part on the embedded identification tokens extracted from the mobile application. 14. The apparatus of claim 13,
Derive one or more identification tokens from the mobile application;
Generate an expected application signature based on the embedded identification tokens and an array of the derived identification tokens; And
Wherein the mobile device is further configured to generate the expected response based at least in part on the expected application signature. 15. The system of claim 14,
Provide non-acceptance to the mobile application;
Further configured to compute an expected hash value using the expected application signature and the nonce; And
Wherein the expected response is the expected hash value. 12. The mobile computing device of claim 11, wherein the stored identification information is an original digital certificate generated for the mobile application upon creation of the mobile application. 17. The system of claim 16, further comprising a mobile operating system;
The access manager,
Computing a first hash value based on the original digital certificate and computing a second hash value based on a digital certificate received from the mobile operating system;
Compare the first hash value with the second hash value;
Determine that the mobile application is valid when the first hash value matches the second hash value; And
Wherein the mobile computing device is further configured to determine that the mobile computing device is invalid when the first hash value does not match the second hash value. 12. The computer-readable medium of claim 11,
i) a software application running on the mobile computing device or remote computing system;
ii) a service provided by a mobile computing device of the remote computing system;
iii) data stored in the mobile computing device or the remote computing system;
iv) hardware of the mobile computing device or the remote computing system; And
v) at least one of these combinations. 12. The mobile computing device of claim 11, further comprising an application policy associated with the mobile computing device; And
Wherein the access manager is configured to control the operation of the trusted mobile application based on the application policy. An access manager configured to operate in a mobile computing device,
The access manager,
Verify the mobile application installed on the mobile computing device based on identification information stored in the mobile computing device and associated with the mobile application;
Prevent the mobile application from accessing the computing resource when verification of the mobile application fails;
Identify the mobile application as a trusted mobile application when the verification of the mobile application is successful;
Allow the trusted mobile application to access the computing resource;
And to control the operation of the trusted mobile application based on an application policy stored in the mobile computing device;
Wherein the verification of the mobile application by the access manager comprises:
Challenge the mobile application to provide a response identifying the mobile application;
Generate an expected response based at least in part on the stored identification information;
Compare the expected response with a response provided by the mobile application;
Determine that the mobile application is valid when the expected response matches a response provided by the mobile application; And
The mobile computing device determining that the mobile computing device is invalid when the expected response does not match the response provided by the mobile application.

Images